Vienna, 25 May 2018

GDPR: noyb.eu filed four complaints over "forced consent" against Google, Instagram, WhatsApp and Facebook Corporations forced users to agree to new privacy policies. A clear violation of the GDPR. Potential penalty: up to € 7 billion in total. Privacy à la “take it or leave it”? The new General Data Protection Regulation (GDPR) which came into force today at midnight is supposed to give users a free choice, whether they agree to data usage or not. The opposite feeling spread on the screens of many users: Tons of “consent boxes” popped up online or in applications, often combined with a threat, that the service cannot longer be used if user do not consent. One the first day of GDPR noyb.eu has therefor files four complaints against Google (Android), Facebook, WhatsApp and Instagram over “forced consent”. Max Schrems chair of noyb.eu: "Facebook has even blocked accounts of users who have not given consent. In the end users only had the choice to delete the account or hit the “agree”-button – that’s not a free choice, it more reminds of a North Korean election process." Overview over complaints Very similar complaints were field with four authorities, to enable European coordination. In addition to the four authorities at the residence of the users, the Irish Data Protection Commissioner (link) will probably get involved in the cases too, as the headquarter of the relevant companies is in Ireland in three cases. Company / Service

Authority

Headquater

Google (Android) Instagram (Facebook) WhatsApp Facebook

CNIL (France) DPA (Belgium) HmbBfDI (Hamburg) DSB (Austria)

USA Irland Irland Irland

Maximium possible penalty (4%) € 3,7 Mrd € 1,3 Mrd € 1,3 Mrd € 1,3 Mrd

Complaint (Original) Link Link Link Link

GDPR prohibits “bundling” The GDPR prohibits such forced consent and any form of bundling a service with the requirement to consent (see Article 7(4) GDPR). Consequently access to services can no longer depend on whether a user gives consent to the use of data. On this issue a very clear guideline of the European data protection authorities has already been published in November 2017 (link). Max Schrems: "Many users do not know yet that this annoying way of pushing people to consent is actually forbidden under GDPR in most cases." Separation of necessary & unnecessary data usage. An end of “forced consent” does not mean that companies can no longer use customer data. The GDPR explicitly allows any data processing that is strictly necessary for the service – but using the data additionally for advertisement or to sell it on needs the users’ free opt-in consent. Max Schrems: "It's simple: Anything strictly necessary for a service does not need consent boxes anymore. For everything else users must have a real choice to say ‘yes’ or ‘no’."

Putting an end to annoying pop-ups. If the complaints of noyb.eu are successful, it will also have a very practical effect: Annoying and obtrusive pop-ups which are used to claim a user's consent, should in many cases be a thing of the past. Schrems: "If companies realize that annoying pop-ups usually don’t lead to valid consent, we should also be free from this digital plague soon. GDPR is very pragmatic on this point: Whatever is really necessary for an app is legal without consent, the rest needs a free ‘yes’ or ‘no’ option." Important for SMEs. The fight against forced consent is also important for small and local companies, which usually cannot force their customers to agree to policies. Schrems: "The fight against forced consent ensures that the corporations cannot force users to consent. This is especially important so that monopolies have no advantage over small businesses." Billion penalties, but will GDPR show teeth? These first complaints will also be a crucial test of the law: with a penalty of 4% of global revenue, Google or Facebook would have to pay more than a billion Euros for violating the law. Schrems: "We probably will not immediately have billions of penalty payments, but the corporations have intentionally violated the GDPR, so we expect a corresponding penalty under GDPR." noyb.eu gets privacy on your phone. Article 80 of the GDPR foresees that data subjects (in this case users from France, Belgium, Austria and Germany) can be represented by a non-profit association, as individual users are usually unable to file the relevant legal complaints. In this case all four users are represented by the non-profit noyb.eu. Schrems: “The non-profit noyb.eu is meant to reasonably enforce the new law, so that the benefits actually reach the users.” Next topics for noyb.eu The complaints about "forced consent" are the first action of the newly founded organization noyb.eu. The Center for Digital Rights is already planning further complaints about the illegal use of user data for advertising purposes or "fictitious consent", such as when companies recognize "consent" to other types of data processing by solely using their webpage. Funding still on the way. So far, noyb.eu is funded by over 2,800 individual supporting members and sponsors (for example, StartPage.com or the City of Vienna). In order to finance the fight against data breaches in the long term, the association is looking for more supporting members. So far, the budget for 2018 is only 69% funded. Schrems: "In 1995 the EU already passed data protection laws, but they were simply ignored by the big players. We want to make sure this does not happen again with GDPR.” Free Photos to use (for free use, image credits "noyb.eu"): Link

Questions: noyb.eu - European Center for Digital Rights Latest info on Twitter: By phone: By e-mail: On our website:

@noybeu and @maxschrems +43 660 2678622 [email protected] www.noyb.eu